Capcom discloses CAPCOM ID breach exposing 11.7 million email addresses and account metadata
Capcom disclosed a breach of its CAPCOM ID online membership service, discovered on October 19, in which an unauthorized third party stole 11,774,247 email addresses and system-specific identification information worldwide. The stolen account metadata includes creation dates, last login dates, login counts and the IP addresses used for the latest logins. In 43 cases, date of birth, gender, country/region and nickname were also exposed. Attackers changed passwords on 196 accounts, which Capcom has already reset. Capcom has not named the actor or the attack method.
Detalhes técnicos
- Discovery date: October 19; figures current as of October 22.
- Capcom says it applied emergency measures, set up an internal task force and reported the incident to its external advisory body, the Security Oversight Committee, on the same day.
- The attack method is still being identified. The article does not attribute the breach to any actor.
- Capcom was previously hit by the Ragnar Locker ransomware gang in November 2020, which claimed 1 TB of stolen data and up to 390,000 people affected.
Remediação
- Capcom reset the 196 accounts with unauthorized password changes and is contacting affected customers through a dedicated support channel.
- Services using CAPCOM ID remain operational, and the relevant authorities have been notified.
- Users should watch for phishing emails impersonating Capcom or its partners, especially those with suspicious links or attachments.
Linha do tempo
-
Capcom discloses CAPCOM ID breach exposing 11.7 million email addresses and account metadata
ler a análise desta fonte ocultar
Capcom disclosed a breach of its CAPCOM ID online membership service, discovered on October 19, in which an unauthorized third party stole 11,774,247 email addresses and system-specific identification information worldwide. The stolen account metadata includes creation dates, last login dates, login counts and the IP addresses used for the latest logins. In 43 cases, date of birth, gender, country/region and nickname were also exposed. Attackers changed passwords on 196 accounts, which Capcom has already reset. Capcom has not named the actor or the attack method.
Technical Details
- Discovery date: October 19; figures current as of October 22.
- Capcom says it applied emergency measures, set up an internal task force and reported the incident to its external advisory body, the Security Oversight Committee, on the same day.
- The attack method is still being identified. The article does not attribute the breach to any actor.
- Capcom was previously hit by the Ragnar Locker ransomware gang in November 2020, which claimed 1 TB of stolen data and up to 390,000 people affected.
Remediation
- Capcom reset the 196 accounts with unauthorized password changes and is contacting affected customers through a dedicated support channel.
- Services using CAPCOM ID remain operational, and the relevant authorities have been notified.
- Users should watch for phishing emails impersonating Capcom or its partners, especially those with suspicious links or attachments.